Migrating from Custom SIEM Log Streaming to Audit Log Drains

Vercel is replacing Custom SIEM Log Streaming with Audit Log Drains. Audit Log Drains forward the events from your Activity Log including audit metadata, which covers more team activity than the legacy integration. If you stream audit logs to a Security Information and Event Management (SIEM) system today, migrate your integration to keep receiving events.

You can run Audit Log Drains and Custom SIEM Log Streaming at the same time. Keep the existing stream active while you set up and validate the drain, then remove it once your SIEM ingests the new events and schema correctly.

Audit Log Drains are available to all Enterprise teams and billed on the volume of data exported. See Drains usage and pricing for details.

1. Create an Audit Log drain

   In Team Settings, go to Drains, click Add Drain, and choose Audit Log as the data type. Audit Log Drains apply to the whole team, so project selection, filters, and sampling aren't available.

2. Point the drain at your SIEM

   Choose a destination that matches your current setup:

   • Custom endpoint: Send events to any HTTPS endpoint with a 200 OK response. Add custom headers for authentication and a signature secret to verify deliveries.
   • S3 bucket: Write events straight to Amazon S3. See Drain Audit Logs to S3 for the AWS IAM setup.
   • Splunk: Send events to your Splunk HTTP Event Collector (HEC). See Drain Audit Logs to Splunk for the HEC setup.
   • Datadog: Send events to Datadog Logs. See Drain Audit Logs to Datadog for site selection and API key setup.
   • Panther: Send events to Panther's built-in Vercel source. See Drain Audit Logs to Panther for source and destination setup.

   For custom endpoints and S3, select JSON or NDJSON to match the format your SIEM expects. Splunk, Datadog, and Panther use fixed formats:

   • Splunk uses the HEC event envelope.
   • Datadog uses JSON tagged for Datadog.
   • Panther uses the standard Audit Log Drain JSON format with Bearer authentication.

3. Update your SIEM parsing

   Map your existing fields to the vercel.audit_log.v1 schema. The context fields move to top-level ipAddress and userAgent fields, the previous and next state in targets becomes a single action-specific payload, and the ISO 8601 occurred_at becomes a timestamp in Unix milliseconds. Audit Log Drains also emit a different set of events than the legacy stream, so review any rules that match on specific action values. See Map the schema for the full field mapping.

4. Test and switch over

   Use the Test button on the Drains page to send a sample event, then confirm your SIEM ingests it. Once events flow correctly, remove the old stream from Security & Privacy > Audit Log.

Audit Log Drains send one event per audit log record. Update your SIEM field mappings:

For full field descriptions, including fields new in the drain schema, see the Audit Log Drains reference. With the Datadog destination, the event fields move to the top level instead of nesting under message, so update any Datadog pipelines, facets, or monitors that reference paths under message.

Audit Log Drains emit a different set of events than Custom SIEM Log Streaming. Some events are logically similar to legacy actions, but the action values don't follow a one-to-one renaming, so review the full list in Events logged and update any detection or routing rules that match on specific action values.

A migrated event looks like this:

{
  "schema": "vercel.audit_log.v1",
  "id": "uev_O0Sn1S6VHTDuKJ6sNs3hLIEy",
  "teamId": "team_123",
  "action": "drain-created",
  "timestamp": 1779444000123,
  "actor": {
    "type": "user",
    "id": "user_123",
    "name": "Test User",
    "email": "test@example.com"
  },
  "requestId": "req_123",
  "payload": {
    "drainUrl": "https://example.com"
  }
}

• Audit Log Drains reference
• Configure Drains
• Drain Audit Logs to S3
• Drain Audit Logs to Splunk
• Drain Audit Logs to Datadog
• Drain Audit Logs to Panther
• Audit Logs